System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler

public class JwtSecurityTokenHandler : SecurityTokenHandler

A SecurityTokenHandler designed for creating and validating Json Web Tokens. See: https://datatracker.ietf.org/doc/html/rfc7519 and http://www.rfc-editor.org/info/rfc7515

public static ISet<string> DefaultInboundClaimFilter

Default claim type filter list.

public static IDictionary<string, string> DefaultInboundClaimTypeMap

Default claim type mapping for inbound claims.

public static bool DefaultMapInboundClaims

Default value for the flag that determines whether or not the InboundClaimTypeMap is used.

public static IDictionary<string, string> DefaultOutboundAlgorithmMap

Default JwtHeader algorithm mapping

public static IDictionary<string, string> DefaultOutboundClaimTypeMap

Default claim type mapping for outbound claims.

public static string JsonClaimTypeProperty { get; set; }

Gets or sets the property name of Properties the will contain .Net type that was recognized when Claims serialized the value to JSON.

See InboundClaimTypeMap for more information.

public static string ShortClaimTypeProperty { get; set; }

Gets or sets the property name of Properties the will contain the original JSON claim 'name' if a mapping occurred when the Claim(s) were created.

See InboundClaimTypeMap for more information.

public ISet<string> InboundClaimFilter { get; set; }

Gets or sets the ISet<T> used to filter claims when populating a ClaimsIdentity claims form a JwtSecurityToken. When a JwtSecurityToken is validated, claims with types found in this ISet<T> will not be added to the ClaimsIdentity.

The default value is ClaimTypeMapping.InboundClaimFilter.

public IDictionary<string, string> InboundClaimTypeMap { get; set; }

Gets or sets the InboundClaimTypeMap which is used when setting the Type for claims in the ClaimsPrincipal extracted when validating a JwtSecurityToken.

The Type is set to the JSON claim 'name' after translating using this mapping.

The default value is ClaimTypeMapping.InboundClaimTypeMap.

public bool MapInboundClaims { get; set; }

Gets or sets the MapInboundClaims property which is used when determining whether or not to map claim types that are extracted when validating a JwtSecurityToken.

If this is set to true, the Type is set to the JSON claim 'name' after translating using this mapping. Otherwise, no mapping occurs.

The default value is true.

public IDictionary<string, string> OutboundAlgorithmMap { get; }

Gets the outbound algorithm map that is passed to the JwtHeader constructor.

public IDictionary<string, string> OutboundClaimTypeMap { get; set; }

Gets or sets the OutboundClaimTypeMap which is used when creating a JwtSecurityToken from Claim(s).

The JSON claim 'name' value is set to Type after translating using this mapping.

The default value is ClaimTypeMapping.OutboundClaimTypeMap

public JwtSecurityTokenHandler()

Initializes a new instance of the JwtSecurityTokenHandler class.

protected virtual string CreateActorValue(ClaimsIdentity actor)

Creates the 'value' for the actor claim: { actort, 'value' }

protected virtual ClaimsIdentity CreateClaimsIdentity(JwtSecurityToken jwtToken, string issuer, TokenValidationParameters validationParameters)

Creates a ClaimsIdentity from a JwtSecurityToken.

public virtual string CreateEncodedJwt(SecurityTokenDescriptor tokenDescriptor)

Returns a Json Web Token (JWT).

public virtual string CreateEncodedJwt(string issuer, string audience, ClaimsIdentity subject, DateTime? notBefore, DateTime? expires, DateTime? issuedAt, SigningCredentials signingCredentials)

Creates a JWT in 'Compact Serialization Format'.

public virtual string CreateEncodedJwt(string issuer, string audience, ClaimsIdentity subject, DateTime? notBefore, DateTime? expires, DateTime? issuedAt, SigningCredentials signingCredentials, EncryptingCredentials encryptingCredentials)

Creates a JWT in 'Compact Serialization Format'.

public virtual JwtSecurityToken CreateJwtSecurityToken(SecurityTokenDescriptor tokenDescriptor)

Creates a Json Web Token (JWT).

public virtual JwtSecurityToken CreateJwtSecurityToken(string issuer, string audience, ClaimsIdentity subject, DateTime? notBefore, DateTime? expires, DateTime? issuedAt, SigningCredentials signingCredentials, EncryptingCredentials encryptingCredentials)

Creates a JwtSecurityToken

public virtual JwtSecurityToken CreateJwtSecurityToken(string issuer = null, string audience = null, ClaimsIdentity subject = null, DateTime? notBefore = default, DateTime? expires = default, DateTime? issuedAt = default, SigningCredentials signingCredentials = null)

Creates a JwtSecurityToken

protected string DecryptToken(JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)

Decrypts a JWE and returns the clear text

public JwtSecurityToken ReadJwtToken(string token)

Converts a string into an instance of JwtSecurityToken.

protected virtual SecurityKey ResolveIssuerSigningKey(string token, JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)

Returns a SecurityKey to use when validating the signature of a token.

protected virtual SecurityKey ResolveTokenDecryptionKey(string token, JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)

Returns a SecurityKey to use when decryption a JWE.

protected virtual void ValidateAudience(IEnumerable<string> audiences, JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)

Determines if the audiences found in a JwtSecurityToken are valid.

protected virtual string ValidateIssuer(string issuer, JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)

Determines if the issuer found in a JwtSecurityToken is valid.

protected virtual void ValidateIssuerSecurityKey(SecurityKey key, JwtSecurityToken securityToken, TokenValidationParameters validationParameters)

Validates the SigningKey is an expected value.

protected virtual void ValidateLifetime(DateTime? notBefore, DateTime? expires, JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)

Validates the lifetime of a JwtSecurityToken.

protected virtual JwtSecurityToken ValidateSignature(string token, TokenValidationParameters validationParameters)

Validates that the signature, if found or required, is valid.

protected ClaimsPrincipal ValidateTokenPayload(JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)

Validates the JSON payload of a JwtSecurityToken.

protected virtual void ValidateTokenReplay(DateTime? expires, string securityToken, TokenValidationParameters validationParameters)

Determines if a JwtSecurityToken is already validated.